I wish I had that card to play! For that specific provider in the example, their ToS explicitly says that, other than your login credentials, they're allowed to do and distribute any and everything they want with any data they collect from the usage of their service[1]. I'd be really curious to see exactly what usage is hiding behind that clause.

> This would be a wonderful way to financially DDoS some organization you just don't like very much.

Right?! It was mind boggling to learn how easily abused of a system it is. Their ToS even states that it's your problem, not theirs, and any call whatsoever to the "CSS key" (the nonexistent font file on their server that redirects to the real file on your server) is and will be charged as a view. You don't even need to hit the site it's embedded in - just hook up to TOR tunnel and throw a curl command to the "CSS Key" URL into an endless loop. And for optional flourish, add fake user-agent, origin, and referrer headers to the curl command. Let it run for a couple hours every week. Since you didn't hit their site, their site analytics never triggered, and they won't know what hit 'em until months later when it reaches a level that warrants finance asking why you blew so far past your budget.

[1] https://www.typography.com/home/cloud-terms.php

I managed the digital analytics for that particular client, and an overly aggressive WAF[1] was in place to block scraping attempts because they'd been burned by font fees in the past. The WAF's browser challenge was poorly designed and as a side effect it destroyed all referral (and therefore channel attribution) data.

I had to work my way through a lot of layers within a Fortune 500 company, from my marketing client to their global infrastructure team, to get buy in to test out (and eventually switch) to Cloudflare as a much more robust solution to their font concerns[2]. Which also just so happened to correct the referral/channel attribution issue I was seeing[3]. Along the way I picked up a pretty comprehensive understanding of licensed fonts, as I had to use completely different approaches for each department and set of red tape I needed to cut through. Marketing, media buying, procurement, IT all have different ways you have to frame the risks and opportunities, even if they're all the same thing said different ways.

[1] https://en.wikipedia.org/wiki/Web_application_firewall

[2] The font issue was irrelevant to me. But my referral data was irrelevant to IT, and they put the WAF causing my problems in place due to the font issue. So I able to get procurement and IT's blessing by enticing them with the additional cost savings and protection from the Cloudflare-based solution.

[3] I was only able to get to procurement and IT in the first place by having the backing of marketing and media buying, who cared not at all about fonts but greatly about website performance, conversion attribution, and being able to analyze visitors by traffic source.